Update routes.php

Add csrf to routes.